Yes. If a telehealth company sends a patient a tracking number for a prescription order, that email is PHI, and the tracking number is part of it. Under 45 CFR 160.103, individually identifiable health information is information created or received by a health care provider that relates to a person’s health condition, to “the provision of health care to an individual,” or to payment for that care, and that identifies the person or gives a reasonable basis to believe it could. When a covered entity or its business associate holds or transmits it, it is PHI. It doesn’t have to be a diagnosis. It has to identify the person and connect them to healthcare.

Look at what a shipment notification from a weight loss, hormone therapy, or men’s health company actually contains:

  • The patient’s name and email address
  • A shipping address, often in the body of the message
  • The sender, which is your brand, so the email says “this person is your patient”
  • An order or tracking number that links the message to one specific fulfillment of one specific prescription

The tracking number matters on its own, too. The HIPAA de-identification standard, 45 CFR 164.514(b)(2)(i), lists eighteen identifiers (paragraphs (A) through (R)) that must be removed before data stops being PHI. The list includes names, street addresses, and email addresses, all of which are contained in a shipment email. The final item, paragraph (R), states “any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section.” The exception in paragraph (c) covers a code a covered entity assigns so it can re-identify de-identified data, and that code must not be derived from or related to information about the individual. A carrier’s tracking number is not that kind of code. It is a unique code tied to one person’s order. It points to a name and address in your systems and in the carrier’s, and it gives anyone holding it a way to obtain that record. You can’t remove it and call the message de-identified, and the email address and patient name would still be there anyway.

 

'But it’s just a shipping update'

This objection assumes a shipment notification is operational rather than clinical, for a retailer, that’s true. However, for a company whose product is a prescription, the order is the care. A notice that a GLP-1 or an estrogen prescription has shipped is a communication about treatment being delivered.

Under 45 CFR 164.506(c)(1), a covered entity may use or disclose PHI for its own treatment, payment, or health care operations, with no separate authorization. “Treatment” is defined in 45 CFR 164.501 to include “the provision, coordination, or management of health care and related services.” A shipment notice is not marketing under the definition in 164.501, because it isn’t encouraging the patient to buy something. It tells them about something they already bought and were prescribed. So the question isn’t whether you may send the notice. The question is how, and through what platform.

 

Where companies get into trouble

Sending it through a platform that won’t sign a BAA

A covered entity may disclose PHI to a business associate only if it obtains satisfactory assurances that the vendor will safeguard the information, and those assurances must be documented in a written contract (45 CFR 164.502(e)). The required contents of that contract are set out in 45 CFR 164.504(e). If your shipment emails run through a notification system, and that vendor hasn’t agreed to a business associate agreement covering the use, then you are disclosing PHI to a vendor with no HIPAA required contract in place. The tracking number, patient’s identity as your patient, their email address, and the order details all go with it.

 

Adding detail you don’t need

The minimum necessary standard in 45 CFR 164.502(b)(1) requires “reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose” of the use or disclosure. A shipment notice needs to say that an order shipped and give the patient a way to track it. It doesn’t need the drug name, the dose, or the condition. A line like “Your order has shipped” with a tracking link does the job. “Your semaglutide 0.5 mg shipped” adds sensitive detail not needed in an inbox preview.

 

Turning the notice into a promotion

Once the message starts encouraging the patient to buy something, you are now marketing. Under 45 CFR 164.508(a)(3), a covered entity generally must obtain the patient’s written authorization for marketing communications. There is an exception in the definition of “marketing” at 45 CFR 164.501 for refill reminders and other communications about a drug “currently being prescribed for the individual,” and it applies only if any financial remuneration is reasonably related to the cost of making the communication. HHS’s refill reminder guidance addresses what the exception includes and what remuneration is allowed. That exception is limited, and an upsell put into a shipping notice generally falls outside it.

 

Assuming the patient’s preference fixes it

HHS allows a covered entity to send unencrypted email to a patient who has been warned of the risk and still asks for it. That is grounded in the individual’s right to request communications by alternative means under 45 CFR 164.522(b). It covers the transmission to the patient. It doesn’t change the fact that your vendor is processing PHI on your behalf, and it doesn’t exempt a BAA.

 

What to do instead

  • Send shipment notices through a platform that will sign a BAA and that secures the message in transit. This is the part of the problem Paubox addresses, making the email itself secure and compliant.
  • Strip the message down. If you must keep using a non-BAA tool for some mail, send nothing that ties the patient to a prescription, no drug, no condition, and ideally a sender name and subject line that don’t announce a treatment relationship. This is harder to do, because the recipient’s email address and your brand name may already identify them as a patient.
  • Point to a secure location. Send a short message that says an update is available, and keep the details behind a login or a secure link.

Read also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQs

Does HIPAA apply to every telehealth company?

HIPAA applies to telehealth companies that qualify as covered entities, generally those that conduct certain transactions electronically, such as billing health plans, while cash-only companies may fall under other rules, such as FTC requirements.

 

Are shipping carriers like UPS or FedEx business associates?

Carriers that only transport packages are generally treated as conduits rather than business associates, though a vendor that stores or processes PHI besides just transporting may be considered a business associate.

 

Does a patient need to give consent before receiving a shipment notice?

HIPAA doesn’t require a separate authorization for treatment-related communications, but a patient’s communication preferences should still be respected.

.